PT-2022-17948 · Liferay · Liferay Portal+1

Published 2022-04-19 · Updated 2024-01-31 · CVE-2022-26595

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3.7 through 7.4.1 Liferay DXP versions 7.2 fix pack 13 through 7.3 fix pack 2

Description The issue arises from improper user permission checks when accessing a list of sites or groups. This allows remote authenticated users to view sites or groups via the user's site membership assignment UI.

Recommendations For Liferay Portal versions 7.3.7 through 7.4.1, consider restricting access to the site membership assignment UI until a patch is available. For Liferay DXP versions 7.2 fix pack 13 through 7.3 fix pack 2, consider disabling the site membership assignment feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

BIT-LIFERAY-2022-26595

CVE-2022-26595

GHSA-822F-JFPG-HG7H

Affected Products

Liferay Dxp

Liferay Portal

References · 12

• https://osv.dev/vulnerability/GHSA-822f-jfpg-hg7h · Vendor Advisory
• https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-26595-unauthorized-access-to-site-group-list · Vendor Advisory
• http://liferay.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26595 · Security Note
• https://osv.dev/vulnerability/BIT-liferay-2022-26595 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-26595 · Vendor Advisory
• https://github.com/liferay/liferay-portal · Note
• https://github.com/liferay/liferay-portal/commit/5b958de42d93f1ba5879a0a20054b14ad7f145c4 · Note
• https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-26595-unauthorized-access-to-site-group-list?p_r_p_assetEntryId=121612195&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612195%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse · Note
• https://t.me/cvenotify/29147 · Telegram Post
• https://liferay.atlassian.net/issues/LPE-17367 · Note
• https://t.me/cibsecurity/41091 · Telegram Post